openssl: heap buffer overflow in CMS key unwrapping

A flaw was found in OpenSSL. A crafted CMS Cryptographic Message Syntax message can cause an 8-byte out-of-bounds heap write when it is decrypted with CMSdecrypt. This issue occurs because the CMS decryption process incorrectly sizes the key-unwrap output buffer when using the AES-WRAP-PAD unwrap...

openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission

A flaw was found in OpenSSL. The Datagram Transport Layer Security DTLS retransmission mechanism fails to properly handle handshake message writes that are suspended before completion. A remote attacker could exploit this vulnerability during handshake message retransmission, causing OpenSSL to...

PT-2026-123393

netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl tlsext ticket key cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read...

Debian dla-4859 : libcrypto3-udeb - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4859 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4859-1 [email protected]...

Exploit for Incorrect Implementation of Authentication Algorithm in Google Android

CVE-2026-0073 CVE-2026-0073: Android adbd TLS auth bypass PoC...

GHSA-W2RW-PV8P-H9C8 vulnerabilities

Vulnerabilities for packages: request-10630-openssl-4.0...

CVE-2016-2183 vulnerabilities

Vulnerabilities for packages: request-10630-openssl-4.0...

Can Agentic Code Review Catch Vulnerabilities Before They Are Merged?

LLM agents have been increasingly adopted for security-focused code review, but existing benchmarks mostly derive the reviewed changes from their later fixes instead of the real-world bug-introducing commits. In this paper, we present SecPRBench, the first comprehensive benchmark for evaluating...

OpenSSL Toolkit 4.1.0

OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer and Transport Layer Security protocols with full-strength cryptography world-wide...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: php (UTSA-2026-143722)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143722 advisory. PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: php (UTSA-2026-143718)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143718 advisory. phpopensslmatcheswildcardname in ext/openssl/xpssl.c underflows the length argument passed to memchr when a TLS server certificate presents a wildcard name whose...

Amazon Linux 2 : edk2 (ALAS-2026-4007)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4007 advisory. Issue summary: A certificate with many nameRelativeToCRLIssuer CRLdistribution points causes disproportionate heap growth when OpenSSL cachesX.509 extensions. Impact summary: Receiving a crafted...

Important: edk2

Issue Overview: Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possib...

Important: edk2

Issue Overview: Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possib...

CLSA-2026-1792414477 openssl: Fix of 4 CVEs

CVE-2026-54872: pad the ladder scalar to a fixed, value-independent width before the cardinality additions so EC scalar multiplication on curves using the generic Montgomery ladder no longer leaks the scalar's magnitude by timing - CVE-2026-75805: guard the issuer and serial-number comparisons in...

Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in OpenSSL

Summary IBM i is vulnerable to multiple vulnerabilities CVE-2026-35189, CVE-2026-54872, CVE-2026-75805, CVE-2026-75806, CVE-2026-77696, CVE-2026-84782 in OpenSSL as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-35189 DESCRIPTION: Issue summary: A certificate...

SUSE-SU-2026:4820-1 Security update for openssl-certs

This update for openssl-certs fixes the following issue: Updated to 2.92 state bsc1286261 CVE-2026-114406 bsc1287180 Removed: - emSign ECC Root CA - C3 - emSign ECC Root CA - G3 - emSign Root CA - C1...

ROS-20261023-73-0002

The vulnerability of TLS and SSL OpenSSL tools is related to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

MiracleLinux 8 : openssl-1.1.1k-18.el8_6 (AXSA:2026-2118:19)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2118:19 advisory. - openssl: heap buffer overflow in CMS key unwrapping CVE-2026-63072 - openssl: compat-openssl: DTLS Retransmits Handshake Messages From a Stale...

openssl security update

1:1.1.1k-18 - Fix CVE-2026-63072: heap buffer overflow in CMS key unwrapping Resolves: RHEL-246295 - Fix CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset Resolves: RHEL-264420 1:1.1.1k-17 - Fixes CVE-2026-28390: Denial of Service due to NULL pointer dereference in CM...